When HAProxy initiates a new connection from a non-local-IP (i.e. the same IP the client connected from) and connects to the backend server, the reply traffic will by default pass out the WAN interface, as its destination is the client-ip. However HAProxy has to recieve these replies. I 'hope' this will function on FreeBSD 9/10 with the divert-reply option. It is used for the option "Transparent ClientIP" in the backend configuration.